South Korea's EU adequacy decision rests on new legislative proposals

South Korea is making changes to its data protection enforcement system that will hopefully clear the way for its long-awaited adequacy decision from the European Union.

The EU only allows frictionless personal data transfers to outside countries if their data protection regimes are deemed to be "adequate," or essentially comparable to that of the EU itself. Lucky recipients of such decisions include Canada, Argentina, Israel, Switzerland and — effectively, via the Privacy Shield framework — the U.S.

South Korea has quite strong data protection rules, and it initiated the process of getting an EU adequacy decision back in 2015. However, there are problems with the independence of its enforcement bodies, and that's what the new legislation is designed to fix.

When South Korea started down the adequacy road, the basis for the proposal was its strict Personal Information Protection Act. The law, enacted in 2011, created a Personal Information Protection Commission that is a data protection authority supposedly with independence but without enforcement powers of its own. The authority's enforcement powers instead reside with the Ministry of the Interior and Safety, which is, of course, not independent from the government.

As far as the Europeans are concerned, that simply doesn't fly.

"With regard to [the] current structure of DPAs in Korea, simply speaking, the MOIS has the power to enforce the PIPA [but has a] lack of independence under EU standard, while the PIPC satisfies the independence standard, but [suffers a] lack of enforcement power," said Kwang Bae Park, a partner and leader of the technology, media and communications group at the Seoul-based law firm Lee & Ko.

So, facing an impasse in the EU adequacy talks, the focus shifted and narrowed to data protection under the Act on Promotion of Information and Communications Network Utilization and Information Protection — or the "Network Act," as it is more conveniently known.

"The issue was that PIPC did not have the enforcement powers that are required from a Data Protection Authority to apply for adequacy," said Claude Moraes, the chair of the European Parliament's Committee on Civil Liberties, Justice and Home Affairs, which sent a delegation to South Korea in late October.

"Therefore, the South Korean authorities went to apply for partial adequacy under the Network Act, given that the KCC is both independent and has enforcement powers," Moraes continued. "Since then, the European Commission has asked the South Korean authorities to clarify the scope, and eventually, the South Korean authorities confirmed that the scope of a partial adequacy based on the Network Act would in fact be limited in a transfer context (although its scope is actually quite broad in a domestic context)."

South Korea's Network Act specifically deals with data protection as it relates to broadcasting and communications, which is a far cry from the scope of the EU General Data Protection Regulation, although it does cover most big businesses' online activities. It is enforced by the Korea Communications Commission.

Article 45(1) of the GDPR says the European Commission may grant an adequacy decision to specific sectors in a country, as opposed to entire countries. Still, it is clearly preferable for a country to get a blanket adequacy decision instead.

Jeongsoo Lee, the KCC's deputy director, told The Privacy Advisor that talks between the European Commission and the KCC had established that South Korea has an "exemplary" data protection regime, and that, "whereas before the adequacy talks centered on the Network Act, now we are exploring the possibility of adequacy with a more comprehensive scope."

That scope would be made possible by amendments to the PIPA that were submitted to the South Korean National Assembly on Nov. 15. According to these changes, the PIPC would essentially win the enforcement functions that it lacks from the MOIS and the KCC.

"Once those bills [are] passed by the National Assembly (and I believe the chances are high), I believe the substantial obstacle for EU’s finding on the adequate level of protection under the Korean data protection laws could be removed and the adequacy decision process will be expedited," Park said via email.

So, would these changes really clear the way for an adequacy decision? The Europeans are certainly keen.

Moraes noted that the PIPC's current lack of enforcement powers mean it is not really fully independent, as it depends on the interior ministry for enforcement. "The independence of the PIPC should … be improved. Hopefully, this is what will happen with the modifications to the PIPA," he said.

Comments

Related Stories

Much of the privacy world is still focused on Europe and the implications of the EU General Data Protection Regulation (and eventually, the ePrivacy Regulation) for digital trade and data practices across borders, particularly between Europe and the U.S. However, Europe holds less than 10 percent of...

Chair of the LIBE Committee Claude Moraes is leading a group of Civil Liberties MEPs to South Korea to discuss data protection issues with the country’s authorities. The visit is part of efforts between the European Union and South Korea to reach an adequacy decision on data transfers between the tw...

While the EU General Data Protection Regulation has been getting all the headlines, privacy professionals working globally know that two of the world's most stringent privacy laws reside in Asia, with Japan's new Personal Information Protection Commission and South Korea's Communications Commission ...

To meet the rising demand for new technologies, South Korea’s Financial Services Commission said it will consider adopting a U.S.-style data-sharing regulation, The Korea Herald reports. Currently, financial institutions must have users agree to the collection of their personal data for wider use. U...

South Korea’s data protection regulator, the Korea Communications Commission, fined eight cryptocurrency exchanges and wallet services for various privacy violations, Fortune reports. Fines ranged from $9,000 to $14,000 for violations such as storing customer data outside the country and for not del...

The IAPP is the largest and most comprehensive global information privacy community and resource. Founded in 2000, the IAPP is a not-for-profit organization that helps define, support and improve the privacy profession globally.

The IAPP is the only place you’ll find a comprehensive body of resources, knowledge and experts to help you navigate the complex landscape of today’s data-driven world. We offer individual, corporate and group memberships, and all members have access to an extensive array of benefits.